Scheduled Task Creation by an Unusual Process
Description
Identifies the creation of a scheduled task by an unusual process such as script interpreters or recently dropped unsigned executables. This behavior is consistent with an adversary attempting to establish persistence.
Query · eql
sequence with maxspan=5m
[process where event.action == "start" and
(
/* common initial access processes */
process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
"msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe","RegSvcs.exe",
"msxsl.exe", "xwizard.exe", "csc.exe", "winword.exe", "excel.exe", "powerpnt.exe",
"powershell.exe") or
(process.name : "javaw.exe" and process.args : "-jar" and process.args_count == 3 and
process.args : ("?:\\Users\\*", "?:\\ProgramData\\*")) or
/* unsigned or untrusted codesign */
((process.code_signature.trusted == false or process.code_signature.exists == false) and
(process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and
not process.code_signature.status : ("errorTimeStamp", "errorCode_endpoint*", "errorExpired", "errorChaining")) or
/* common abused paths */
(process.executable :
("?:\\Users\\Public\\*",
"?:\\Users\\*\\AppData\\Roaming\\*",
"?:\\ProgramData\\*",
"?:\\Windows\\Microsoft.NET\\*",
"?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*",
"?:\\Users\\*\\AppData\\Local\\Temp\\7z*",
"?:\\Users\\*\\AppData\\Local\\Temp\\Rar*",
"?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*",
"\\Device\\CdRom*") and not process.code_signature.trusted == true) or
/* execution from a mounted device */
(process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*")
) and
/* known FPs */
not (process.name : "rundll32.exe" and process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*" and process.parent.name : "msiexec.exe") and
not (process.name : ("rundll32.exe", "regsvr32.exe") and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
not (process.code_signature.trusted == true and process.executable : ("?:\\Users\\*\\AppData\\Roaming\\*", "?:\\ProgramData\\*")) and
not (process.name : "rundll32.exe" and process.args : "tsworkspace,TaskUpdateWorkspaces") and
not (process.name : "rundll32.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and process.command_line : "*pcrpf.dll,NotifyFirmwareUpdateStaged*") and
not (process.executable : "\\Device\\Mup\\*\\OneDriveSetup.exe" and process.args : "/ALLUSERS") and
not (process.name : "rundll32.exe" and
process.command_line : ("*PWMTR32V.dll,InitializeSettingsDuringInstallation*", "*RunDll_EnableBits*")) and
not (process.name : "powershell.exe" and
process.command_line :
("*:\\Program Files\\*", "*:\\Program Files (X86)\\*",
"*Packages\\Plugins\\Microsoft.AdminCenter.AdminCenter*",
"*:\\WINDOWS\\ccmcache\\*",
"*EEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBGADgAQQBjAHcA*",
"*UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAA*",
"*-EncodedCommand*",
"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ")) and
not (process.name : "powershell.exe" and
process.parent.executable : ("?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
"?:\\Program Files (x86)\\Spiceworks Agent Shell\\AgentShellService.exe",
"?:\\Program Files (x86)\\ITSPlatform\\plugin\\scripting\\platform-scripting-plugin.exe",
"?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe",
"?:\\Program Files (x86)\\Lenovo\\VantageService\\*\\Lenovo.Vantage.AddinInstaller.exe",
"?:\\ProgramData\\Lenovo\\LenovoNow\\Downloads\\LenovoNow.Updater.exe",
"?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoFirstRunExperiencePackage\\x86\\LenovoWelcomeTask.exe",
"?:\\Program Files (x86)\\Microsoft Intune Management Extension\\agentexecutor.exe",
"C:\\Banyan\\Canopy\\Leaf\\leaf_desktop_app.exe",
"?:\\windows\\system32\\msiexec.exe",
"?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe",
"C:\\Windows\\CCM\\OSDRunPowerShellScript.exe",
"C:\\Windows\\System32\\runonce.exe")) and
not (process.name : "powershell.exe" and user.id : "S-1-5-18") and
not (process.name : "powershell.exe" and process.parent.name : "powershell.exe" and process.parent.args : "-EncodedCommand" and process.parent.args : "cABvAHcAZQByAHMAaABlAGw*") and
not (process.name : "powershell.exe" and process.args : ("-nomeAgente", "\\\\*\\*.ps1", "& 'C:\\oracle_unified_agent\\scripts\\unified-agent-permissions.ps1' ; exit $($LASTEXITCODE)")) and
not (process.parent.name : "rundll32.exe" and process.parent.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*") and
not (process.name : "rundll32.exe" and process.command_line : ("*zzzzInvokeManagedCustomActionOutOfProc*", "*tsworkspace,WorkspaceSilentSetup*")) and
not process.executable :
("?:\\Program Files (x86)\\*.exe",
"?:\\Program Files\\*.exe",
"?:\\Windows\\SysWOW64\\OneDriveSetup.exe",
"?:\\Windows\\System32\\MRT.exe",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe",
"C:\\Windows\\SystemTemp\\SupportAssistAgent\\*\\SupportAssistDeployment.exe") and
/* DOCs opened from network file share trigger an office default scheduled task */
not (process.name : ("winword.exe", "excel.exe", "powerpnt.exe") and not process.working_directory : "C:\\*") and
not process.hash.sha256 :
("3d95157908cee58d19193c93c5f2b0a06910b8123a4211b0ea059ff66f2506e0",
"79dbc3cf0d4cdc0f2150ab5e2bf3457ba54297202500f26f1a1d48e455f7c54a",
"62d96982e2c2d58682471af9a9d0727ba49199d48b7766c318886e8e7e23670a",
"ef330f95416162866f5d8b9cd509066ab4168cfcc66e305006be1952905d47e6",
"cf635f97d0a3bea30f348277777f36db6b14aea0e7711471e5fb2e13167b80cd",
"3c1169568774b7ce8a96e137983b059f030eb3983c369cfb12ea2c59cf3f56ad",
"edaf602006b53dc936a35d0f9e6de51c552c0203ebe814cb68b1d5cbc81f4b49",
"82c97648fa358c31fb47e44762938738ad3080880b84b69d9c303d708ab160c2",
"4aff93803f1915f3a10f19a1d1e065483c4d11221e3c2792b3de1807c7bf1d9a",
"f9e86b3a6275429f5dbecccc2020e498032a96fc02dd8bdb2a1cc5b5bf2b473b",
"7b20331e03018ca74f0212aff3d5a1a66e2375188691df56c9b2b89ba84ad38b",
"dc3bcf4dee3b8c3ca0062284f53e5f717085bd3f3ac6b1ac70492425a7cf2474",
"81fac89743d43b741a009541a9c365ed3213f49cf6314d9c50418ab0d9e82528",
"7d2c761823b183cd34a8c1c0b7b6f572d26a0265bfe65afe913faf60d27de844",
"f943329f6399ecd418268484bc61d98887b7fc8454c2409a79adc3b965ae75a0",
"ae27abffcc06755840792abb83a67b847782afa01bb26c2631671ed3932930b6",
"6af431b97e8571a2c072a746a44b5e0dcb3685268f75459e789063e03b7698cb",
"b31ed4807259472689f984e348f10e15125fae9df1298e6befddd5411a2a7dda",
"d0916c34fb5a3580baf74f401277ceb480eec5b4e0a61aea3400f2491922019a") and
not (process.name : "powershell.exe" and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
not (process.name : "powershell.exe" and
process.parent.executable : ("C:\\WINDOWS\\_ScriptingFramework\\Modul\\Engine.exe",
"C:\\Windows\\System32\\gpscript.exe",
"C:\\Windows\\IMECache\\*\\RjImeHost.exe")) and
process.pe.original_file_name != "Adobe Installer" and
not process.parent.executable :
("C:\\Windows\\highsystem.NET\\Client\\hdnClSvc.NET.exe",
"C:\\Program Files (x86)\\AOMEI\\AOMEI Backupper\\*\\unins*.exe",
"C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcconfigexec.exe",
"C:\\Windows\\highsystem.NET\\Client\\hdnClSvc.NET.exe",
"C:\\Program Files (x86)\\AOMEI\\AOMEI Backupper\\*\\unins*.exe",
"C:\\Program Files (x86)\\Common Files\\InstallShield\\*.exe",
"C:\\Program Files\\RepairTech\\Syncro\\Syncro.App.Runner.exe",
"C:\\Program Files (x86)\\*\\unins*.exe") and
not (process.name : "powershell.exe" and process.args : "RemoteSigned") and
not (process.name : "cscript.exe" and process.parent.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*", "C:\\Users\\*\\AppData\\Local\\Temp\\is-*.tmp\\*.tmp")) and
not (process.name : "powershell.exe" and process.parent.code_signature.subject_name in ("Patch My PC, LLC", "Grammarly, Inc.", "FastTrack Software ApS") and process.parent.code_signature.trusted == true)
] by process.entity_id
[file where event.action : "creation" and process.name : "svchost.exe" and
file.path : ("?:\\Windows\\Tasks\\*", "?:\\Windows\\System32\\Tasks\\*") and
/* excluding via Powershell cmdline is also vulnerable to evasion */
not (Effective_process.name : "powershell.exe" and
file.path :
("?:\\WINDOWS\\System32\\Tasks\\PSWindowsUpdate",
"?:\\Windows\\System32\\Tasks\\npcapwatchdog",
"?:\\Windows\\System32\\Tasks\\ChocoUpgrade",
"?:\\Windows\\System32\\Tasks\\ansible-ansible.windows.win_updates",
"?:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\PowerShell\\ScheduledJobs\\ansible-win-updates",
"?:\\WINDOWS\\System32\\Tasks\\PRISM Monitoring - System Data",
"?:\\Windows\\System32\\Tasks\\PRISM Cloud Monitoring - System Data")) and
not (file.name : "Microsoft Office 1? Sync Maintenance for *" and file.size >= 5200 and file.size <= 5300 and
Effective_process.name : ("winword.exe", "excel.exe", "powerpnt.exe")) and
not (file.name : "OneDrive Standalone Update Task-S-1-5-21-*" and Effective_process.executable : "\\Device\\Mup\\*") and
not (file.path : "C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\RemoteApp and Desktop Connections Update\\*" and Effective_process.executable : "C:\\Windows\\System32\\xwizard.exe") and
not (file.name like ("TSS-Framework_wsusutil", "PSAppDeployToolkit_MicrosoftCorporation_*") and Effective_process.name : "powershell.exe")
] by Effective_process.entity_id